amadey | 52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3

Analysis

max time kernel
150s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
20/07/2024, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
Size 1.8MB
Sample240720-jn22wsshkr
SHA256 52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3
MD5 768cc2bc4492f58807c21af9ba5dcf46
SHA1 ae0458343e7763ca5f63c7044d2f72b741489b52
SHA512 b5c53afb04469c281d4d01a2c3a0d3be6db28035d9c2c88aafedec9c2b70eef26fb6340c793bdceba923c6c07a442654cd101def3a6871253d5f3cd3c6c3f8fe
SSDEEP 49152:GIcnFe//9EdIjXR0PgCjvBIfyj2yaqHd0awfSrDFpSiG:d0uGCjXRrCjpIfWHd05feFpZG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey stealc 4dd39d default evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.30

Botnet

4dd39d

http://77.91.77.82

Attributes

install_dir
ad40971b6b
install_file
explorti.exe
strings_key
a434973ad22def7137dbb5e059b7081e
url_paths
/Hun4Ko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

http://85.28.47.31

Attributes

url_path
/5499d72b3a3e55be.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorti.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorti.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorti.exe

Executes dropped EXE 6 IoCs

pid	Process
3740	explorti.exe
2352	2bf56f97ee.exe
2716	bc1adeca14.exe
656	explorti.exe
5920	explorti.exe
1552	explorti.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe
Key opened	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Wine	explorti.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Microsoft\Windows\CurrentVersion\Run\2bf56f97ee.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000015001\\2bf56f97ee.exe"	explorti.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000\Software\Microsoft\Windows\CurrentVersion\Run\bc1adeca14.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\bc1adeca14.exe"	explorti.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa75-45.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
3740	explorti.exe
656	explorti.exe
5920	explorti.exe
1552	explorti.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorti.job	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
3740	explorti.exe
3740	explorti.exe
656	explorti.exe
656	explorti.exe
5920	explorti.exe
5920	explorti.exe
1552	explorti.exe
1552	explorti.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe
Token: SeDebugPrivilege	1556	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
2716	bc1adeca14.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
1556	firefox.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe
2716	bc1adeca14.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2352	2bf56f97ee.exe
1556	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 3740	1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe	83
PID 1712 wrote to memory of 3740	1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe	83
PID 1712 wrote to memory of 3740	1712	52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe	83
PID 3740 wrote to memory of 2352	3740	explorti.exe	84
PID 3740 wrote to memory of 2352	3740	explorti.exe	84
PID 3740 wrote to memory of 2352	3740	explorti.exe	84
PID 3740 wrote to memory of 2716	3740	explorti.exe	85
PID 3740 wrote to memory of 2716	3740	explorti.exe	85
PID 3740 wrote to memory of 2716	3740	explorti.exe	85
PID 2716 wrote to memory of 1424	2716	bc1adeca14.exe	87
PID 2716 wrote to memory of 1424	2716	bc1adeca14.exe	87
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1424 wrote to memory of 1556	1424	firefox.exe	90
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91
PID 1556 wrote to memory of 1696	1556	firefox.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe
"C:\Users\Admin\AppData\Local\Temp\52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
  "C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Users\Admin\AppData\Local\Temp\1000015001\2bf56f97ee.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\2bf56f97ee.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\1000016001\bc1adeca14.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\bc1adeca14.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com/account
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1556
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2008 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 25751 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1787b4a-7c27-4cc7-be58-dddba1d23d21} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" gpu
        6⤵
        
        PID:1696
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2416 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 26671 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6bafdb64-24ad-482d-9b78-7a754ddbf620} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" socket
        6⤵
        
        PID:2720
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3276 -childID 1 -isForBrowser -prefsHandle 3268 -prefMapHandle 3264 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fbc1aab-4b8b-47dc-857e-e614bd9256b1} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
        6⤵
        
        PID:1872
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3856 -childID 2 -isForBrowser -prefsHandle 3852 -prefMapHandle 3844 -prefsLen 31161 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71f83ac1-714d-4972-b400-8a0ec2289190} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
        6⤵
        
        PID:2728
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4788 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4780 -prefMapHandle 4776 -prefsLen 31161 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e3e4837-5128-424b-9b5d-15b273671596} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" utility
        6⤵
        Checks processor information in registry
        
        PID:4000
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 3 -isForBrowser -prefsHandle 5616 -prefMapHandle 5600 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16ba5675-9bea-4f8d-969a-1dfa129421c7} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
        6⤵
        
        PID:6008
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5756 -childID 4 -isForBrowser -prefsHandle 5700 -prefMapHandle 5696 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5660f072-16df-433f-bca2-f6dcad9e85f8} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
        6⤵
        
        PID:6020
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 5 -isForBrowser -prefsHandle 5808 -prefMapHandle 5812 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1304 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22cb196a-431e-4f82-929b-f52460799c64} 1556 "\\.\pipe\gecko-crash-server-pipe.1556" tab
        6⤵
        
        PID:6044

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:656

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5920

C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\activity-stream.discovery_stream.json
Size 21KB
SHA256 b5cbcbac69778e778e4c89643fd82ef82a84d7769beb724e70cd01abadcff081
MD5 37a84c44e65ac86c642f40f1106f914c
SHA1 36b67433ced21dfb636ebea04b56f0e14ac7737c
SHA512 d36aae718c2e6421fbb7b7d788940f2fc2581d3caf1575531170ba26985b4ca09f240d078a6017ecb099d31b0e7ce6f419c7d728dadaf50aff62dac9669aa554
SSDEEP 384:zJtusYhKZv02YUXZp5v05J3HSJs/CQE6Z5Cswok7yauk3a5:zXZN9X3QvCh/7ydk3a5
MD5 SHA1 SHA512 SSDEEP

Submit Download

8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\n9orreff.default-release\cache2\entries\8A2034D325DC0B5C9E11EDDA3FC70A54C8DC1C0D
Size 13KB
SHA256 ce5d558f271a90afc22a5ebd8408e89ba7bb0de65b1901dfec03729b9dded514
MD5 8879e776e20b6fe9835b4bc80ff7aa51
SHA1 d56eccde7a0fede80351620f712044cef90cc0b9
SHA512 5e02eb8f7d4fdeff4971a5f9323b5dd93f36f64f3c4b1aa434a2bb26dccaf0e6752df37569937d62a8a86f0c2ec278a4b6626c8a2ff6beb9117557dc87e757be
SSDEEP 384:H485u9fiGLm4pU8gft2WlOX8lPLZZB7t0lpDII4Lv:nUBi8mCUfft2WAX8tzB7eD8R
MD5 SHA1 SHA512 SSDEEP

Submit Download

2bf56f97ee.exe

Path C:\Users\Admin\AppData\Local\Temp\1000015001\2bf56f97ee.exe
Size 678KB
SHA256 37a7ad7e8ace3477705c037277832204c5296be48c38fcdd4e8056e8d2a6e4c1
MD5 a192a740bcba9f4b4482923147a2fbc5
SHA1 bd8701c05a3283c7cd062f60ecbb746a5c10f6e8
SHA512 3c36017e94261f61560f2dd17a152cd3252ba03f68779532895043a3c9f6eb676605407b32338f08b96ece194b3a972d869746753a4e0d4a3c07f1f994ec6903
SSDEEP 12288:GCRBnNMnUso7YNQSDzdYD/jGW/nShXnyGPdnlnSr3/35elqDU66txRxDgF:GC7SnU1wQIRHW/nSx3VlnQ3v0lqDtSXs
MD5 SHA1 SHA512 SSDEEP

Submit Download

bc1adeca14.exe

Path C:\Users\Admin\AppData\Local\Temp\1000016001\bc1adeca14.exe
Size 1.2MB
SHA256 efe01bebb0a932475260bc531c0975101a8ef199b92accda79162c31e870279c
MD5 61a64baa92e6104096287ba54d59ef2c
SHA1 f2ed797ff7ce5c94f27c58e2e2b9a68c9ff5644e
SHA512 8a55d83a703d989bbb0db8c98e9d5190b8b0526edc8f325d60ed5e023c40678ea9844442dd77f798af341172a7e7b47b5b2bfa90ea6af83ca1a05ca496e6ae97
SSDEEP 24576:1qDEvCTbMWu7rQYlBQcBiT6rprG8aLC2Sbly7TWEPje:1TvC/MTQYxsWR7aLC2dW
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorti.exe

Path C:\Users\Admin\AppData\Local\Temp\ad40971b6b\explorti.exe
Size 1.8MB
SHA256 52685b9bf471464447b847029c2a0e5459033702549dd4700767a793cffbadd3
MD5 768cc2bc4492f58807c21af9ba5dcf46
SHA1 ae0458343e7763ca5f63c7044d2f72b741489b52
SHA512 b5c53afb04469c281d4d01a2c3a0d3be6db28035d9c2c88aafedec9c2b70eef26fb6340c793bdceba923c6c07a442654cd101def3a6871253d5f3cd3c6c3f8fe
SSDEEP 49152:GIcnFe//9EdIjXR0PgCjvBIfyj2yaqHd0awfSrDFpSiG:d0uGCjXRrCjpIfWHd05feFpZG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-1

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 8KB
SHA256 f488b91a9e1433197e0c8f5286cb45b2a35f1e3b18d848600391dc960cc01839
MD5 78fd19709d8f2731aeb241cbc89ef249
SHA1 24b95221b3d912188a373e039d6e2962c0cb43f9
SHA512 bdec2cfb5ec4bcc739558d6cd534d390f91ae13bbabbd4e65ce1846f77ef7429642f61a7056e96e09d2b216bc7d3452d7677529bf43607e1ce3d868c1370eb88
SSDEEP 48:A9cOHx5oqOjOebOJ4G3bcpebvpf+4l3b:wx5oqkOebOJ4G3bcpebvpf+4l3b
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\AlternateServices.bin
Size 12KB
SHA256 dffec8c213945ed2ca7c4914be86bdcf964ad928399e0be0b362e66ed7648a68
MD5 ad8e4d4da37f42133939370908bb9948
SHA1 93616cf2ecae0e8096a2328516eb0f89b62d8e3b
SHA512 6fd6b7050b24508a3eeffd1e6eb2043d3f61f7fd5a8e31401dce26b96ae2c0ae97f222042b9924990d0300c5e375f00095881b988df568f2397df95a8a6eb906
SSDEEP 96:wx5oqbkOebOJ4G3blpebvpf+4G3b2bPG3bPgbgziG3bi7bLG3b:wx5nbkZCuHrf7
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 9be176d484d36c97baadc572c554737f40012470c5247d14734f6ec8b7c579eb
MD5 6cb87769c94bd91a53c7c8374bf62329
SHA1 04dd78632e606ac2790bd1f676a5df356176af2b
SHA512 c9b8e1e34670ce37dd940317fc751cd10bf6b65405e8c77b89944102faecf06c1122f78d347168b04c08ece8f32f6d3492e8f210f3ffb8a4ea2ecf66f6c22e5d
SSDEEP 96:Q4nQ+Q+h+R+eFl66Joz0dzgClKtmSStBzxSMF9ZbkW6QX0BBK3hmsKPP/PhxqW2:m/66Joz0dzgCl6mSSlrvZboHKhvcPDt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 c9313429afeade10bd54c08af2a96803e826a74dfef5b89370bc9a374c65da02
MD5 9f97c6c3d30498f58bfc4627991e948f
SHA1 13088cc27d5dcd4e096d4ab68c9d8741fb58c27b
SHA512 0fb21fe8c639d3270e529ce30360e90cf1b832c43202dd2a401302a76a847a6e3fba5aa0baa75b226de28c93bc378596afee0f614dc3963654dab8035b5a6837
SSDEEP 96:VBzxSMF9ZbkW6QX0BBK3hmqKPP/PrWZb4nQ+Q+h+R+eFl66Joz0dzgClKtmSSM:drvZboHKhDcPCx/66Joz0dzgCl6mSSM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 16KB
SHA256 763ed5a9cad76e6b9fcc69b49585a3efd5bb5869f5cc64ed878edf7b102bcb66
MD5 719d9008f82ff6c53a4ecea7c1adc451
SHA1 29457c64cbe558d04241f85330eec29f2d35257d
SHA512 f0271882836cbdd8cf3eda4b71bd582f3eb96ae5738e8d865b9816593a210ed35e7c1a3a292fa905b4d0ca0c0d41e32753cf35c1c7a3ac3811f733492b18e441
SSDEEP 384:P87FDk4EXfDrlJJblbPB/66JozQzgC1b8boq2iPZ:U7lgDrlJJblbPkmaBh
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 32368634c887a6f89d7b95499b08b61e8c1a2a6a97eec7c8aad6c9165a00f297
MD5 ad32ed9fd2ae3240ee90f79cd2b7bdef
SHA1 0c460ec68a6d6f028b4bae1a416d13c433987c48
SHA512 43ed7fe4a181bf24ef96b97fca3a6c31c69664277201a2b152b4e9ec69584adf206f1e386195b820e0beb2e583f423aa940e44be5c9fc3e4b82de8774d01d717
SSDEEP 96:b4nQ+Q+h+R+eFl66Joz0dzgClKtmSSS1BzxSMF9ZbkW6QX0BBK3hmqKPP/PhxqW:b/66Joz0dzgCl6mSSArvZboHKhDcPDt
MD5 SHA1 SHA512 SSDEEP

Submit Download

42669676-0b9c-435d-bdc1-3847afb49a92

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\42669676-0b9c-435d-bdc1-3847afb49a92
Size 27KB
SHA256 4693ce1eedd45e9c9d0322608a2c9bbf075238f9bdda44e2fbdd93bf88353a81
MD5 b7fa28525bfe2237f99b228ccb5587f9
SHA1 a00c9d67bdf91cb67dc7f42c14b714de6771aa59
SHA512 d4cb199d744450b1981a39f4648da9edfd10f9779ef3305dca14eb2eacf8397e50b47fe210f595ab9b6b584cb562cc88fce232e244e9fcc08f56eee317685f98
SSDEEP 384:FBir5n0ORx5E+9Hqhx/1dGX1zmvzGYx+S:qxHqhxH2mvhj
MD5 SHA1 SHA512 SSDEEP

Submit Download

49aa7e5a-256e-41ac-82b5-683a22c6985c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\49aa7e5a-256e-41ac-82b5-683a22c6985c
Size 982B
SHA256 4037ea9f4f67b0397340713c9386761f539519676782e5e7cae90287b341fb9f
MD5 b0e1c293988f83e72c7db36288afedac
SHA1 40fa788a3851d6433f8ded8d47c27fde74109ed0
SHA512 ea30289011885a3e84eb1b34988967052efa2bacae93a8ba6001c65a50a7d3c836bb9141234eda96411505d086edc23d50714083227b72e130dcc588df83a1a5
MD5 SHA1 SHA512

Submit Download

a0ba888a-7c70-4de6-a688-f4f76216f91b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\datareporting\glean\pending_pings\a0ba888a-7c70-4de6-a688-f4f76216f91b
Size 671B
SHA256 6e52694171ef115f56a05d090db0f6bc5b2e16f5c99fdfe2e1713961ffad7bd0
MD5 13a6fc99c49cd5313a759305feddff3b
SHA1 386fc1bf952a271eabccce8bf9608dfbf9bf22a7
SHA512 b085084e3477cb8c0e92241ded083dfe25472f237456e93dd5095d7e21ad1da876f52a23d83288572ad399b59541236e9547adae8af6a7190e8603688c6446ae
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 12KB
SHA256 1a996eb820aed1e5606ea548a2452016ae60915e1329935e040800555cb53853
MD5 2e875be6a0ac9c38bd616f78d8cd184e
SHA1 3193f77f418c231987190a12c93f98604814c777
SHA512 91cb794eac2454dc4a094666e3624cd3ffb8ea07f6bc3b809876eecdfe49f1ba422a77946d055ea1f45adb614a257958dec4f47af5331e98bd4c7adaa051e6e7
SSDEEP 192:U5nKRJfKi1InZzAgS/ScdZaLwzADlsNbwaXxhs7KBw8HmRS:R2ZzAgS3iLwzJ28w/o
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 15KB
SHA256 fb1682e4dbda715c369e8fe1ce3212e83e94fe7961e0e9d8db22c50b42a52ad5
MD5 55c1c2b1d49c55483f647e1be10e5999
SHA1 bd48dccf1c826b926b66f4dd2db74d576522df2b
SHA512 73318b0f870b471232506339554b5618bfb25e44353df9399dab41bf6ee7043bcab866a1db0839e1e8aa6b0e198247581726f1b7c5582fb82fd9c56b98b5e451
SSDEEP 192:UOnKRJf7i1InZzAgS/ScdZaLwzADlsNbwaXr+hs7SiBw8HO3H7gl:CtZzAgS3iLwzC2dwDA
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs-1.js
Size 10KB
SHA256 ce893035b6fb354f5a480910cb9684739981bf568436e9909e6679d5ef3bc9b3
MD5 f30995d5a7b748bd6d210cd246de1b88
SHA1 e79746226e51482195e949a8647c1106e87090d6
SHA512 158ae5f1ecc704bbe3b5ae54d9b7f9b273b5c48f799926f1199005b92070b46d5d397ee4266cf733e3e7ce1cc2e001b6dec6a53ccb9bd6013c1fdb6d9b6dc0d5
SSDEEP 192:R5nKRJfKi1InZzAgS/ScdZaLwzADlsNbwaXxhs7aBw8HG:E2ZzAgS3iLwzJ2Uwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n9orreff.default-release\prefs.js
Size 8KB
SHA256 43dbe71f6a8b9ad086604dd3f3ef5d26a02793206453ca450f11b61367d0054e
MD5 4cb94504d5b3675709545bbca40c08a3
SHA1 803a981bee4b89953eacf25697cb63abd9694afa
SHA512 7137abfa8d68230fb25f43f29b668cbe72f33ca9ea4fd2bb535842ab3510214eac3f95a89d572ab28f8214827d65585db9397298fb9bebdb198ef08bfcdfbd0e
SSDEEP 192:R5nKRJfKTy8xUcdzky60z+KaXohs7aBw8HG:E6x5yxe2Uwb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/656-60-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/656-277-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/1552-2663-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/1552-2662-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/1712-17-0x0000000000FB0000-0x000000000145A000-memory.dmp

Download

memory/1712-0-0x0000000000FB0000-0x000000000145A000-memory.dmp

Download

memory/1712-1-0x00000000778D6000-0x00000000778D8000-memory.dmp

Download

memory/1712-2-0x0000000000FB1000-0x0000000000FDF000-memory.dmp

Download

memory/1712-3-0x0000000000FB0000-0x000000000145A000-memory.dmp

Download

memory/1712-4-0x0000000000FB0000-0x000000000145A000-memory.dmp

Download

memory/2352-37-0x0000000000D30000-0x0000000001308000-memory.dmp

Download

memory/2352-40-0x0000000000D30000-0x0000000001308000-memory.dmp

Download

memory/3740-2643-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2659-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-18-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-422-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-417-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-416-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-407-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-1095-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2635-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2652-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-21-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2670-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-19-0x00000000006D1000-0x00000000006FF000-memory.dmp

Download

memory/3740-2656-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2657-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2658-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2664-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-2660-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-394-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/3740-20-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/5920-2650-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download

memory/5920-2651-0x00000000006D0000-0x0000000000B7A000-memory.dmp

Download